Category: News

Recent days of Security News From_the_desk_of_Paul_-_031505.pdf

IT managers and their staffs now have the Windows Security Log Encyclopedia, a new Windows tool for monitoring, intrusion detection and for carrying out computer forensics.

The new tool covers all nine audit categories of Windows Server 2003 and illuminates the subtle, yet critical, differences between Windows Server 2003, 2000, and XP regarding security events.

According to Smith, “The Windows security log is vital to successfully monitor all aspects of Windows security. Commenting on the techniques used to develop the tool, Smith added, “I have reverse-engineered every event ID in the security log, along with the codes and other detailed fields within each event.

Smith has provided design consultation to developers of event log monitoring products and written more than a dozen articles on the subject, several of which now reside on Microsoft’s TechNet Web site.

This valuable tool is freely available online at www.ultimatewindowssecurity.com.

http://www.securitypronews.com/news/securitynews/spn-45-20050312OnlineWindowsSecurityLogEncyclopediaFree.html

A silicon.com article (http://software.silicon.com/security/0,39024655,39128296,00.htm) revealed Immunity and its founder Dave Aitel have been causing a stir in the security world in recent months with a business model branded “unethical” but entirely above-board. The greatest source of growing concern appears to focus on the NDA and the potential for anybody to sign up and pay the price for notification of vulnerabilities.

One rival bug finder, who operates along the more traditional lines of informing the affected vendor of the flaw in its product and working with them to patch it before releasing any details of the vulnerability, has hit out at Immunity Inc. Drew Copley, senior research engineer at eEye Digital Security, told silicon.com the situation of signing members to a non-disclosure agreement in return for information on security vulnerabilities is “extremely unethical”. Simon Perry, VP security strategy at CA, told silicon.com: “Knowledge cannot be effectively controlled. “NDAs in the IT community as a whole are not taken seriously and there do not appear to be adequate controls to ensure that the information does not leak to those who have an interest in creating a dangerous exploit. It does not improve security overall,” he added.

Perry also questioned whether Aitel’s customers are getting value for money. Because vendors are kept out of the loop, flaws go un-patched while Immunity’s customers are given a workaround. “You’re given a workaround by Immunity, but you don’t have a fix — a patch from the vendor that permanently addresses the problem.

http://software.silicon.com/security/0,39024655,39128621,00.htm

At its recent TechFest event, it described how its Vigilante project is using “honeypots” to automatically spot and remove worms as they enter networks. Microsoft added that this is a research project, and it has not decided if or when such tools should be built into Windows.

A computer honeypot is a server with an unpublished IP address. Honeypots are usually connected to the internet rather than a LAN, and the use of otherwise redundant IP addresses virtually guarantees that any attempts to access the server are from a worm or other unauthorised activity. Worms often select random IP addresses to attack, so are just as likely to attack a honeypot server as they are a genuine server. Monitoring tools running on the honeypot inspect the incoming TCP/IP connections and can automatically produce signature files that would allow a suitable firewall to filter out any such packets sent to production servers.

Honeypots are popular with security experts, but Microsoft would be the first major software vendor to build such tools into mainstream computer software. It is well placed to do so because honeypot systems are best deployed using server virtualisation tools.

Microsoft detailed the Vigilante project in a paper written by two Microsoft researchers with Manuel Costa and Jon Crowcroft from the University of Cambridge. In a section examining the scale of the problem, the authors note, “Worms can spread too fast for people to respond. For example, the Slammer worm infected 90 percent of vulnerable hosts in 10 minutes.”

The report concludes that honeypots can deal with the problem. “Our preliminary results show that Vigilante can effectively contain fast-spreading worms that exploit unknown vulnerabilities.”

Lab data from the Vigilante project indicates that a small number of honeypot systems could protect a large network of servers. “[Our data] shows that a very small fraction of detectors, 0.001, is enough to contain [infection from a worm like Slammer] to less than 10 percent of the vulnerable population.” The researchers noted, “Dynamic dataflow analysis is able to detect an attack even when it does not overwrite program data structures. Dynamic dataflow analysis can also be used with self-modifying code and dynamically generated code. Furthermore, access to the source code is not required.”

In addition to the honeypot project, Microsoft is developing a protective architecture that can re-write software as it is being run, to add new checks to prevent hackers from hijacking servers by exploiting buffer overflows.

http://www.vnunet.com/news/1161845

The group, made up of Oracle (Quote, Chart), Hewlett-Packard (Quote, Chart), Veritas, Sun Microsystems (Quote, Chart), Open Text, Hitachi Data Systems, Network Appliance (Quote, Chart) and Plasmon, expects to have resources available on the Internet Law & Policy Forum (ILPF) Web site in the next six months.

The ILPF is a non-profit organization that provides a neutral forum for challenges posed by the Internet on law, policy, technology and businesses worldwide.

The CMEI site will host documentation on best practices for information retention and maintenance regulations, provide counsel and exchange information with various businesses, legislative bodies and regulatory agencies in various workshops, and publish checklists and summaries of legal and regulatory requirements for interested companies.

Those sorts of conflicting policy goals, as well as some of the weak language found in ambiguous regulations was the main reason for the formation of the working group, according to Harald Collet, CMEI chairman and Oracle records management and compliance support product manager. With businesses focused on complying with the deadlines of specific regulations, he said, such as Sarbanes Oxley, they now have to work on building a framework that is more all-encompassing.

Collet points to research conducted recently by AMR Research, which said companies would spend $6.1 billion in 2005 just to gain compliance with the regulations contained in the Sarbanes-Oxley Act; of that $6.1 billion, $1.7 billion will go toward the technology that helps companies meet compliance standards. But while companies within the working group would stand to gain from selling their products directly to customers — Oracle sells software like its E-Business Suite 11i.9 to help get companies in line with regulations like Sarbanes Oxley and HIPAA — Collet said the goal of the working group is to help customers by finding the best answers for them.

“The vendors that are involved in this all go into it with a spirit of trying to address the technology issues around this,” he said, “and I think that everyone who is involved in trying to solve this issue on the vendor side, they have an interest in clarifying the obligations and issues and pointing the way towards technology solutions that can help with this; it’s a win-win for everyone.

Collect said membership is open for any vendor looking to join the CMEI working group, after paying the admission price of $10,000.

http://www.techweb.com/wire/security/159400873

The Business Software Alliance and Information Systems Security Association released results of their Information Security Survey, a Web poll of 850 worldwide members of ISSA conducted in December and January.

According to the survey, 44% of companies said a member of senior management is responsible for IT security, up from 39% in October 2003.

BSA, a consortium of 25 software companies that includes Cisco Systems, IBM, and Microsoft, supports enforcement of copyright and software-counterfeiting laws.

Among other findings: 78% of companies have a formal information-security program; 90% have an information-security officer; and 55% have a chief privacy officer.

http://www.informationweek.com/story/showArticle.jhtml;jsessionid=5CWAFMGITIQIIQSNDBCCKH0CJUMEKJVN?articleID=60403494